Back to Checks
gcp

Cloud Storage services are protected by VPC Service Controls

cloudstorage_uses_vpc_service_controls
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:cloudresourcemanager.googleapis.com/Project

GCP Projects are evaluated to ensure they have VPC Service Controls enabled for Cloud Storage. VPC Service Controls establish security boundaries by restricting access to Cloud Storage resources to specific networks and trusted clients, preventing unauthorized data access and exfiltration.

Prowler logoProwlerprowler-provider-gcp

Risk

Projects without VPC Service Controls protection for Cloud Storage may be vulnerable to unauthorized data access and exfiltration, even with proper IAM policies in place. VPC Service Controls provide an additional layer of network-level security that restricts API access based on the context of the request.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_uses_vpc_service_controls

Recommendation

Enable VPC Service Controls for all Cloud Storage buckets by adding their projects to a service perimeter with storage.googleapis.com as a restricted service. This prevents data exfiltration and ensures API calls are only allowed from authorized networks.

Remediation

Other

11) Open Google Cloud Console → Security → VPC Service Controls
22) Create a new service perimeter or select an existing one
33) Add the relevant GCP projects to the perimeter's protected resources
44) Add 'storage.googleapis.com' to the list of restricted services
55) Configure appropriate ingress and egress rules
66) Save the perimeter configuration

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.accesscontextmanager.accesscontextmanager_client import (
    accesscontextmanager_client,
)
from prowler.providers.gcp.services.cloudresourcemanager.cloudresourcemanager_client import (
    cloudresourcemanager_client,
)
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_uses_vpc_service_controls(Check):
    """
    Ensure Cloud Storage is protected by VPC Service Controls at project level.

    Reports PASS if:
    - A project is in a VPC Service Controls perimeter with storage.googleapis.com
      as a restricted service, OR
    - The Cloud Storage API access is blocked by VPC Service Controls
      (verified by vpcServiceControlsUniqueIdentifier in the error response)

    Otherwise reports FAIL.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        protected_projects = {}
        for perimeter in accesscontextmanager_client.service_perimeters:
            if any(
                service == "storage.googleapis.com"
                for service in perimeter.restricted_services
            ):
                for resource in perimeter.resources:
                    protected_projects[resource] = perimeter.title

        for project in cloudresourcemanager_client.cloud_resource_manager_projects:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=cloudresourcemanager_client.projects[project.id],
                project_id=project.id,
                location=cloudresourcemanager_client.region,
                resource_name=(
                    cloudresourcemanager_client.projects[project.id].name
                    if cloudresourcemanager_client.projects[project.id].name
                    else "GCP Project"
                ),
            )
            report.status = "FAIL"
            report.status_extended = f"Project {project.id} does not have VPC Service Controls enabled for Cloud Storage."
            # GCP stores resources by project number, not project ID
            project_resource_id = f"projects/{project.number}"

            if project_resource_id in protected_projects:
                report.status = "PASS"
                report.status_extended = f"Project {project.id} has VPC Service Controls enabled for Cloud Storage in perimeter {protected_projects[project_resource_id]}."
            elif (
                project.id
                in cloudstorage_client.vpc_service_controls_protected_projects
            ):
                report.status = "PASS"
                report.status_extended = f"Project {project.id} has VPC Service Controls enabled for Cloud Storage in undetermined perimeter (verified by API access restriction)."

            findings.append(report)

        return findings

References